Chromium User Activation Bypass Leading to File Picker UI Spoofing (P3)

Vulnerability Overview Vulnerability ID: Regression 440523110 Vulnerability Type: User Activation Bypass Description: Through delays in and , an attacker can bypass user activation verification, causing the file selection dialog to render fully within an attacker-controlled split pane, even though the user is visually anchored to Google Drive. Impact Scope Affected Component: Chromium Affected Version: 440523110 Severity: P3 Access Privileges: Default Access Remediation Status: Submitted Fix Version: 7154160 Fix Description: Resolves the user activation bypass issue caused by delays in and . POC Code Additional Information Reporter: az_@gmail.com Assigned To: ag_@google.com Verifier: az_@gmail.com CC: az_@gmail.com, cz_@chromium.org Code Change: 7154160 Build Number: 143.0.7499.193 Component Labels: UI-Browser, TopChrome, TabStrip CVE: 2026-11216 Design Document: Deprecated Additional Comments Additional Verification: The same proof-of-concept test was conducted in the Brave browser, yielding identical results. Video Demonstration: A demo video is provided, showing user activation being preserved when the file picker is not fully blocked. Summary This vulnerability bypasses user activation verification via delays in and , allowing the file selection dialog to render fully in an attacker-controlled split pane. The fix has been submitted, and the corrected version is 7154160.

Goal Reached Thanks to every supporter — we hit 100%!

Chromium User Activation Bypass Leading to File Picker UI Spoofing (P3)